Advisory Catalog

mlflow vulnerable to Path Traversal

gradio vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

mlflow Path Traversal vulnerability

Request smuggling leading to endpoint restriction bypass in Gunicorn

sqlparse parsing heavily nested list leads to Denial of Service

Pydantic regular expression denial of service

NiceGUI allows potential access to local file system

Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode

Potential DoS via the Tudoor mechanism in eventlet and dnspython

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`open

Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

DIRAC: Unauthorized users can read proxy contents during generation

Ryu Infinite Loop vulnerability

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service.

Voilà Local file inclusion

Pillow buffer overflow vulnerability

Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

Gradio's CI vulnerable to Command Injection

gradio Server-Side Request Forgery vulnerability

ansys-geometry-core OS Command Injection vulnerability

PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file

SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

ESPHome vulnerable to Authentication bypass via Cross site request forgery

`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

Denial of service via regular expression

RCE in TranformGraph().to_dot_graph function

greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.

Apache Airflow: Ignored Airflow Permission

Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

PaddlePaddle command injection in paddle.utils.download._wget_download

PaddlePaddle command injection vulnerability

RPyC's missing security check results in code execution when using numpy.array on the server-side.

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

Phone information disclosure vulnerability

LangChain directory traversal vulnerability

Docassemble unauthorized access through URL manipulation

ZenML Server Remote Privilege Escalation Vulnerability

diffoscope Path Traversal vulnerability

ESPHome vulnerable to remote code execution via arbitrary file write

orjson does not limit recursion for deeply nested JSON documents

langchain Server-Side Request Forgery vulnerability

Uninitialized Variable in fastecdsa

Onnx Directory Traversal vulnerability

pypqc private key retrieval vulnerability

Potentially untrusted input is rendered as HTML in final output

cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override